The present invention pertains to protecting data in computer networks and more particularly, to a method and system for protecting data such that the data is made unrecoverable after a predetermined finite period of time, or when desired.
In recent years, individuals and businesses have increasingly employed computer and telecommunications networks, such as the World Wide Web (WWW), to store and access data remotely and to send and receive messages via e-mail or instant messaging services. Typically when a user remotely accesses data or sends a message or data to another computer, the data or message is sent through one or more intermediate systems within the network where the data is temporarily written to memory or data storage devices associated with those intermediate systems. The memory and data storage devices of the intermediate systems and the communications lines within the network are susceptible to the malicious actions of a third party in which the messages or data may be intercepted or otherwise accessed. To prevent these messages or data from being improperly accessed, various data encryption methods have been developed to prevent a third party from being able to access the clear data or message even if the data or message is intercepted or otherwise accessed. Some encryption methods are also used for integrity checking and/or authentication of a message or data by allowing a user to determine whether the message or data has been altered, while authentication allows a a user to verify the source of a message.
While encryption protects encrypted data from being understood by someone not in possession of the decryption key, the longer such encrypted information is stored, the greater potential there may be for such a key to fall into the wrong hands. For example, key escrows are often maintained which keep records of keys. Such records may be stored for convenience in order to recover encrypted data when a key has been lost, for law enforcement purposes, to permit the police to eavesdrop on conversations regarding criminal activities, or for business management to monitor the contents of employee communications.
In existing systems, there are various events that may result in a message remaining stored beyond its usefulness to a receiving party. First, there is no guarantee that a receiver of an encrypted message will promptly delete it after it has been read. Additionally, electronic mail and other types of messages may automatically be “backed-up” to a secondary storage system, either at the destination system or within one or more of the intermediate systems through which the e-mail has passed. These back-up copies are stored for often indeterminate times, and are outside the control of the message originator. Thus, it is apparent that even under ordinary circumstances, a message may remain in existence well beyond its usefulness, and that, as discussed above, such longevity may result in the privacy of the message being compromised. There is no way to guarantee that all copies of the data are deleted. However, if the data is encrypted, all that is necessary to ensure that the data is unrecoverable is to ensure that the decryption key is destroyed.
Existing systems for secure communications, such as the Secure Sockets Layer (SSL) protocol, provide for authenticated, private, real-time communications. In the SSL protocol, a server system generates a short-term public/private key pair that is certified as authentic using a long-term private key belonging to the server. The client uses the short-term public key to encrypt a symmetric key for use during the session. The server periodically changes its short-term private key, discarding any previous versions. This renders any records of previous sessions established using the former short-term public key unrecoverable. Such a system is sometimes referred to as providing “perfect forward secrecy”. These existing systems, however, provide no mechanism for setting or determining a finite “lifetime”, in terms of decryptability, for stored encrypted data or messages independent of a real-time communications session.
Ephemeral encryption has been developed to ensure that ephemeral keys, i.e., encryption and decryption key pairs that have a predetermined lifetime, are securely created, maintained, and destroyed by ephemeral agents (“ephemerizers”). Ephemerizers create, manage, and destroy encryption keys in a secure manner that prevents the keys from existing beyond the predetermined lifetime. In general, an ephemerizer is able to provide ephemeral encryption and decryption services to many users so as to amortize the cost of managing the ephemeral key pairs over the many users.
Previous methods of ephemeral encryption require authentication of the client and the ephemerizer, which is computationally intensive. In addition, authentication requires that the ephemerizer see either the clear-text or the message encrypted with the long term key of the user. If another party than the intended user is able to obtain the message encrypted with the long term key of the user, then the other party can store this encrypted message and decrypt it at a later time when the long term key of the user may become available due to theft or coercion.
It would be desirable therefore to have a system in which data has a finite lifetime and in which during the finite lifetime only the authorized user can make use of the ephemerizer to obtain either a clear-text message or a message encrypted with the long term key of the user. The encrypted message should be effectively protected after the ephemeral key is destroyed, assuming the authorized user protected the long term key during the lifetime of the ephemeral key and kept no copies of the message except for copies encrypted with the ephemeral key.